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The tunnelling apparatus for a data communication network including 
a fire-wall (1) which defines outside and inside regions and forms a 
security barrier. This prevents objects in the outside region from 
accessing objects in the inside region, while objects in the inside 
region are permitted to access objects in the outside region. An 
outside interface computer (3) is located in the outside region, and an 
inside interface computer (2) interfaces between the firewall and 
objects in the inside region. 

A device in both the computers is provided for determining the 
identities of predetermined trusted objects in the inside region to 
which access is allowed from the outside region. A device in the 
outside computer responds to a request sent from an object in the 
outside region and cooperates with the determining device to check if 
the request is directed to one of the trusted objects. If the request 
is so directed the request is routed to the inside interface computer. 
A device in both interface computers responds to the request directed 
to the trusted object for forming a data communication connection to 
the outside object. The segments of the data connection located in the 
inside region and extending through the firewall are formed under the 
exclusive control of the inside interface computer. A segment of the 
data communication connection extends from the outside interface 
computer to the object that sent the request and is formed under the 
control of the outside interface computer. 

USE - For isolating computer an network resources inside firewall 
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